Integrator-owned orchestration for the iPhone. LivePhoneController is main-actor UI state with injected TV actor, security repository and selected-TV store. It never implements command admission or watch grant issuance. KeychainSelectedTelevisionStore keeps a stable opaque TV UUID and address in device-only Keychain storage, separate from credentials.

Pairing is explicit. Restore/reconnect only uses an existing token. Failed metadata reads/writes do not start pairing; changing the address requires forgetting the old target. Forget disconnects first and retains the identity if deleting credentials fails. Trust failure only offers a certificate candidate; explicit approval stores a pin and requires a separate pairing action. Demo mode disconnects live transport.

Tests inject actors and stores; they do not access the real Keychain or network. Native composition lives in Apps/iPhone/PhoneAppComposition.swift. Device lock/relaunch and Keychain accessibility remain physical gates.